Subject: Re: FYI 4 update: security considerations (fwd)

From: April Marine <[email-masked]>
Date: Thu, 31 Dec 1998 13:24:44 -0800 (PST)

some more comments..

---------- Forwarded message ----------
Date: Thu, 31 Dec 1998 15:58:12 -0500
From: Gary Kessler <[email-masked]>
To: April Marine <[email-masked]>
Cc: [email-masked]
Subject: Re: FYI 4 update: security considerations

Hi April.

I don't think what you have here is too long nor too negative. I would add
a couple of things, however... 

First, this is a great place to speak to the fact that all users of the
Internet have a security role to play. I.e., when I give out my password
to someone else and I don't know what they are doing, I am providing an
opening not to just my system, but to my network and to the Internet as a
whole. THAT is my I have the responsibility to keep my access information
to me. 

Second, I have a couple of papers on security considerations for the
Internet and choosing passwords that you are welcome to copy from
liberally and/or reference, if you would like. They can be found at
http://www.hill.com/library/secure.html and
http://www.hill.com/library/password.html, respectively. Any other papers
at http://www.hill.com/library that I wrote or co-wrote can also be used
if they can be of any help. 

Later!
/kess

At 10:17 AM 12/31/98 -0800, you wrote:
>Happy New Year all!
>
>I was on the hook to revise the Security Considerations section of the
>update to FYI 4.  So, here is a crack at it.  I have a feeling that there
>are some who will not like this approach, so I thought I would run it by
>the whole list insteading of just slipping it to Ray.  
>
>Things I think might be contentious: 1. it may be too long?  2. it may be
>too negative? 
>
>I tried to address the top 3 or 4 security-related things I think a new
>user should be aware of, but these may be things only I feel strongly
>about.  So I toss it to the list to see where consensus may reign.
>
>thanks,
>April
>----------
>
>FYI 4
>3. Security Considerations
>
>   The question "is the Internet secure?" can be a confusing one for a
>   new user, who will hear many assurances that it is secure and many
>   scary stories saying it is not secure.  There are a few basic rules
>   of thumb to remember that will address most concerns.
>
>   First, users should make it a rule never to share their account
>   passwords with anyone, certainly never with anyone unknown to them.
>   Learning a password is the easiest way for someone to break into a
>   system.  Possibly a user may think that their files are not that
>   interesting to anyone, but someone may be able to get a foothold
>   from one innocuous account to other places in the same computer
>   system.  Many good security practices for users can be found in the
>   Users Security Handbook (FYI?).
>
>   Second, understand that there are means for people to track the
>   information a user sends via email, the files one downloads, and
>   the sites visited on the web.  People with legitimate system
>   priviledges have access to information that a user may prefer to keep
>   private.  No responsible site administrator or network engineer
>   will violate users' privacy out of personal curiousity; however,
>   people with legitimate system or network priviledges have access to
>   information about users.  If someone less legitimate gains such
>   priviledges, possibly by attaining illegal access to a system, they
>   also will have access to this information.  This situation is not a
>   problem for most people, but it should be understood that email
>   sent a year ago may still exist in some system's backup archive
>   tape and theoretcially could be resurrected and reviewed.
>
>   Third, before giving personal information over the Internet, such
>   as filling in a form on a Web page, a user should review the site's
>   privacy policy to see how they will use and protect this
>   information.  Do they sell their users' names and email addresses?
>   Do they share them with their advertising partners?  Do they couple
>   names with the pages visited and provide that information to their
>   associates?  It is best to understand how far such information will
>   go before providing it, and a responsible site will be happy to
>   explain their policies regarding privacy of information.
>
>   Finally, there are means to heighten the security and privacy of
>   one's Internet usage.  Details are beyond the scope of this
>   document, but means for encrypting data, for digitally signing
>   messages and files, for doublechecking the authenticity of
>   information, and for filtering out portions of Internet data exist.
>   One can find more information about these options by using a search
>   engine to find information about "data encrpytion", "digital
>   signatures", "babysitting software", or "checksums".
>
>
>